What is mixed content?

Mixed content is any subresource an https page loads over plain http. The page itself is encrypted, but those individual requests are not, so an attacker on the network can read or replace them and the browser can no longer claim the whole page is secure.

What is the difference between active and passive mixed content?

Active, called blockable in the specification, covers scripts, stylesheets, fonts, frames and plugin data. Browsers refuse to load it. Passive, called optionally blockable, covers images, video and audio. Browsers load it but remove the padlock and log a warning.

Should I use the URL scan or paste the HTML?

Use the URL for anything published. It fetches the page on our server, so it also sees the response headers, which is the only way to tell a real upgrade-insecure-requests policy from a meta tag, and it tests whether each insecure file is reachable over https. Paste the source for staging builds, local files and pages behind a login, where that scan runs entirely in your browser and nothing is uploaded.

Where do I get the page source?

Open the page and press Ctrl+U on Windows or Cmd+Option+U on a Mac, then select all and copy. You can also right click and choose View Page Source. Do not use Inspect, because that shows the DOM after scripts have run rather than what was served.

Does mixed content affect SEO?

Indirectly. Google treats https as a signal, and blocked scripts and stylesheets can stop the rendered page from matching what you intended, which affects what gets indexed. The larger cost is usually visitors seeing a warning instead of a padlock.

Will a protocol relative URL trigger mixed content?

No. A URL that starts with two slashes inherits the scheme of the page, so it resolves to https on an https page. It is not flagged here. Writing the full https URL is still clearer for anyone reading the markup later.

What does upgrade-insecure-requests do?

It is a Content Security Policy directive that tells the browser to rewrite every http subresource request on the page to https before sending it. It is a good safety net, but it only helps when the target host actually serves the file over https.

Why is my page still insecure when the scan is clean?

The scan reads the HTML you served. Requests created later by JavaScript, such as fetch, XHR, dynamically inserted script tags or WebSocket connections over ws, are not in that HTML. Check the Network panel in DevTools for those.

Are links to http pages mixed content?

No. An anchor is a navigation, not a subresource, so an http link does not affect the padlock on the current page. It does send the visitor to an unencrypted page, which is worth fixing for its own reasons.

How do I stop mixed content coming back?

Store asset URLs without a hardcoded scheme, add upgrade-insecure-requests to your policy, and use a platform that serves every asset over https by default. Grigora issues certificates and serves site, email and store assets over https automatically.

Free Mixed Content Checker

Enter the URL of an https page and see every image, script, stylesheet, iframe, media file and CSS url() still requested over plain http. Results are split into what the browser blocks and what only costs you the padlock. No public URL yet? Paste the source instead and the scan runs in your browser.

Free, no signup Reads the real response headers Paste mode for staging pages

Scan a published page

We fetch the page from our server, so the report also covers the security headers it was served with, and every insecure file is tested over https to see whether the obvious fix would actually work.

Public pages only. Anything behind a login returns the login screen, and local or private network addresses are refused. Use the paste option for those.

Padlock fixed? Keep it that way

Mixed content usually starts with the hosting setup.

Grigora issues and renews certificates for you and serves every page, image, form and store asset over https by default, so the only way http creeps back in is a third party embed you pasted yourself.

Start free See the builder

How to check a page for mixed content

Four steps from view source to a clean padlock.

Enter the page URL

Any public http or https page. The scan reads the HTML the server actually sends, along with its security headers.

Or paste the source

For staging builds, local files and pages behind a login, paste the markup instead. That scan stays in your browser.

Read the two groups

Active findings are blocked by the browser. Passive findings load but break the padlock.

Rewrite and re-check

Change each http URL to https, confirm the host serves it there, then run the scan again.

How to check for mixed content, step by step

Real screenshots of the tool, taken while scanning a live pricing page.

1
Enter the page URL
Or switch to the paste tab and check a template that is not published yet.
2
Choose the page to scan
Start with the pages carrying the most third party embeds. That is where an http reference usually hides.
3
Confirm every subresource is https
Active mixed content is blocked outright by the browser. Passive content is only warned about. They are separated here so you know which one breaks the page.

When to run this check

Six moments an http subresource is the likely culprit.

The padlock disappeared

Find the one image or iframe that turned a secure page into a neutral one.

After moving a site to https

Old absolute http URLs survive migrations inside content, themes and widgets.

A widget stopped rendering

Blocked active content fails silently, so an empty box is often mixed content.

Auditing a third party embed

Ad tags and chat scripts sometimes pull assets over http from their own hosts.

Before enabling HSTS

Clear the insecure requests first, so nothing breaks when downgrades stop working.

Checking a template or theme

Hardcoded http asset URLs in a theme repeat on every page that uses it.

Fixing it on your platform

Where http URLs usually hide, by platform.

WordPress

Run a search and replace across posts for http://yourdomain.
Check theme and plugin files for hardcoded http asset URLs.
Re-copy the source and scan again.

Shopify

Open the theme code editor and search assets for http://.
Check custom Liquid sections and any embedded scripts.
Preview the page, view source, paste it here.

Grigora

Every site, form and store asset is served over https by default.
Only pasted third party embeds can introduce http URLs.
Scan a published page to confirm the embed is clean.

Static or custom builds

Grep the build output for the string http:// in src and href.
Check CSS files for url() and @font-face entries.
Add upgrade-insecure-requests to your CSP header.

Grigora vs. other ways to find mixed content

Side by side.

Capability	Grigora	Browser console	Online scanners	Crawler suites
Sends your HTML anywhere	No, parsed in browser	No	Yes, uploaded	Yes, uploaded
Separates active from passive	Yes, with reasons	Mixed in the log	Sometimes	Yes
Checks url() inside CSS	Yes	Only if requested	Rarely	Yes
Works on a staging or local page	Yes, paste the source	Yes	No, needs public URL	No, needs public URL
Signup required	No	No	Often	Yes

Common errors and how to fix them

Eight things that break a padlock, and what to change.

Blocked loading mixed active content

Cause: A script, stylesheet or iframe requested over http.

Fix: Rewrite the URL to https. If the host has no certificate, self host the file or drop it.

Padlock replaced by a neutral icon

Cause: An image, video or audio file over http.

Fix: Serve the media over https from your own domain or a CDN that supports it.

Hardcoded http in the database

Cause: Old posts store absolute http URLs in their content.

Fix: Run a search and replace across content for http://yourdomain to https://yourdomain.

A base tag poisoning every path

Cause: A base href pointing at http.

Fix: Remove the base tag or point it at https. It rewrites every relative URL on the page.

Fonts falling back to Times

Cause: An @font-face src over http, which counts as blockable.

Fix: Update the font URL to https, or host the font files with the rest of your assets.

Background image missing the padlock

Cause: A url() in a style block or style attribute over http.

Fix: CSS URLs are easy to miss because they are not in the markup. Update them too.

Form warning before submit

Cause: A form action pointing at http.

Fix: Post to the same https origin. Browsers warn the visitor and disable autofill otherwise.

Nothing found but the padlock is still off

Cause: The insecure request comes from JavaScript at runtime, not the HTML.

Fix: Open the Network panel, filter by http and reload. Fetch and XHR calls are not in the source.

Mixed content in four numbers

The rules worth remembering before you start editing.

Severity classes in the spec: blockable and optionally blockable

Active http subresources a modern browser will load on an https page

CSP directive that fixes most of it: upgrade-insecure-requests

Bytes uploaded when you paste the source, that scan stays in your browser

Frequently asked questions

Ten answers about mixed content and https.

Related free tools

Other utilities that pair with the Mixed Content Checker.

Https on every page, without the maintenance

Site, newsletter and store on one platform, with certificates handled for you, starting free.

Start building free

Free Mixed Content Checker

Scan a published page

Mixed content usually starts with the hosting setup.

How to check a page for mixed content

Enter the page URL

Or paste the source

Read the two groups

Rewrite and re-check

How to check for mixed content, step by step

Enter the page URL

Choose the page to scan

Confirm every subresource is https

When to run this check

The padlock disappeared

After moving a site to https

A widget stopped rendering

Auditing a third party embed

Before enabling HSTS

Checking a template or theme

Fixing it on your platform

WordPress

Shopify

Grigora

Static or custom builds

Grigora vs. other ways to find mixed content

Common errors and how to fix them

Blocked loading mixed active content

Padlock replaced by a neutral icon

Hardcoded http in the database

A base tag poisoning every path

Fonts falling back to Times

Background image missing the padlock

Form warning before submit

Nothing found but the padlock is still off

Mixed content in four numbers

Frequently asked questions

Related free tools

Broken Link Checker

Redirect Checker

Canonical Checker

Accessibility Checker

Page Performance Checker

Website Launch Checklist

Https on every page, without the maintenance